feat(public_checks): demote to non-protocol contract; introduce hand-written interface

dbanks12 · dbanks12 · commit 5d2eb1965fe9 · 2026-05-14T19:25:16.000Z
diff --git a/barretenberg/cpp/pil/vm2/constants_gen.pil b/barretenberg/cpp/pil/vm2/constants_gen.pil
@@ -19,7 +19,6 @@ namespace constants;
     pol CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS = 3;
     pol MULTI_CALL_ENTRYPOINT_ADDRESS = 4;
     pol FEE_JUICE_ADDRESS = 5;
-    pol PUBLIC_CHECKS_ADDRESS = 6;
     pol FEE_JUICE_BALANCES_SLOT = 1;
     pol UPDATED_CLASS_IDS_SLOT = 1;
     pol FLAT_PUBLIC_LOGS_HEADER_LENGTH = 1;
diff --git a/barretenberg/cpp/src/barretenberg/aztec/aztec_constants.hpp b/barretenberg/cpp/src/barretenberg/aztec/aztec_constants.hpp
@@ -25,7 +25,6 @@
 #define CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS 3
 #define MULTI_CALL_ENTRYPOINT_ADDRESS 4
 #define FEE_JUICE_ADDRESS 5
-#define PUBLIC_CHECKS_ADDRESS 6
 #define FEE_JUICE_BALANCES_SLOT 1
 #define UPDATED_CLASS_IDS_SLOT 1
 #define FLAT_PUBLIC_LOGS_HEADER_LENGTH 1
diff --git a/noir-projects/aztec-nr/aztec/Nargo.toml b/noir-projects/aztec-nr/aztec/Nargo.toml
@@ -6,5 +6,6 @@ type = "lib"
 
 [dependencies]
 protocol_types = { path = "../../noir-protocol-circuits/crates/types" }
+standard_addresses = { path = "../standard_addresses" }
 sha256 = { tag = "v0.3.0", git = "https://github.com/noir-lang/sha256" }
 poseidon = { tag = "v0.3.0", git = "https://github.com/noir-lang/poseidon" }
diff --git a/noir-projects/aztec-nr/aztec/src/lib.nr b/noir-projects/aztec-nr/aztec/src/lib.nr
@@ -47,6 +47,7 @@ pub(crate) mod logging;
 pub mod utils;
 pub mod authwit;
 pub mod public_checks;
+pub mod public_checks_interface;
 pub mod macros;
 
 pub mod test;
diff --git a/noir-projects/aztec-nr/aztec/src/public_checks.nr b/noir-projects/aztec-nr/aztec/src/public_checks.nr
@@ -1,7 +1,6 @@
-use crate::context::calls::PublicStaticCall;
 use crate::context::PrivateContext;
-use crate::protocol::abis::function_selector::FunctionSelector;
-use crate::protocol::constants::PUBLIC_CHECKS_ADDRESS;
+use crate::public_checks_interface::PublicChecksInterface;
+use standard_addresses::PUBLIC_CHECKS_ADDRESS;
 
 // docs:start:helper_public_checks_functions
 /// Asserts that the current timestamp in the enqueued public call enqueued by `check_timestamp` satisfies
@@ -10,14 +9,7 @@ use crate::protocol::constants::PUBLIC_CHECKS_ADDRESS;
 /// This conceals an address of the calling contract by setting `context.msg_sender` to the public checks contract
 /// address.
 pub fn privately_check_timestamp(operation: u8, value: u64, context: &mut PrivateContext) {
-    let selector = comptime { FunctionSelector::from_signature("check_timestamp(u8,u64)") };
-    PublicStaticCall::<15, 2, ()>::new(
-        PUBLIC_CHECKS_ADDRESS,
-        selector,
-        "check_timestamp",
-        [operation as Field, value as Field],
-    )
-        .enqueue_view_incognito(context);
+    PublicChecksInterface::at(PUBLIC_CHECKS_ADDRESS).check_timestamp(operation, value).enqueue_view_incognito(context);
 }
 
 /// Asserts that the current block number in the enqueued public call enqueued by `check_block_number` satisfies
@@ -27,14 +19,7 @@ pub fn privately_check_timestamp(operation: u8, value: u64, context: &mut Privat
 /// address.
 pub fn privately_check_block_number(operation: u8, value: u32, context: &mut PrivateContext) {
     // docs:start:enqueueing
-    let selector = comptime { FunctionSelector::from_signature("check_block_number(u8,u32)") };
-    PublicStaticCall::<18, 2, ()>::new(
-        PUBLIC_CHECKS_ADDRESS,
-        selector,
-        "check_block_number",
-        [operation as Field, value as Field],
-    )
-        .enqueue_view_incognito(context);
+    PublicChecksInterface::at(PUBLIC_CHECKS_ADDRESS).check_block_number(operation, value).enqueue_view_incognito(context);
     // docs:end:enqueueing
 }
 // docs:end:helper_public_checks_functions
diff --git a/noir-projects/aztec-nr/aztec/src/public_checks_interface.nr b/noir-projects/aztec-nr/aztec/src/public_checks_interface.nr
@@ -0,0 +1,41 @@
+use crate::context::calls::PublicStaticCall;
+use crate::protocol::abis::function_selector::FunctionSelector;
+use crate::protocol::address::AztecAddress;
+
+/// Hand-written interface stub for the `PublicChecks` standard contract.
+///
+/// The `PublicChecks` contract exposes two view functions that can be enqueued
+/// from private context via `enqueue_view_incognito` to assert timestamp or
+/// block-number constraints without revealing the calling contract address.
+///
+/// The selectors are derived with `comptime { FunctionSelector::from_signature(...) }`,
+/// which matches exactly what the `#[aztec]` macro generates for the real contract.
+pub struct PublicChecksInterface {
+    pub target_contract: AztecAddress,
+}
+
+impl PublicChecksInterface {
+    pub fn at(target_contract: AztecAddress) -> Self {
+        Self { target_contract }
+    }
+
+    pub fn check_timestamp(self, operation: u8, value: u64) -> PublicStaticCall<15, 2, ()> {
+        let selector = comptime { FunctionSelector::from_signature("check_timestamp(u8,u64)") };
+        PublicStaticCall::new(
+            self.target_contract,
+            selector,
+            "check_timestamp",
+            [operation as Field, value as Field],
+        )
+    }
+
+    pub fn check_block_number(self, operation: u8, value: u32) -> PublicStaticCall<18, 2, ()> {
+        let selector = comptime { FunctionSelector::from_signature("check_block_number(u8,u32)") };
+        PublicStaticCall::new(
+            self.target_contract,
+            selector,
+            "check_block_number",
+            [operation as Field, value as Field],
+        )
+    }
+}
diff --git a/noir-projects/aztec-nr/standard_addresses/src/lib.nr b/noir-projects/aztec-nr/standard_addresses/src/lib.nr
@@ -4,3 +4,7 @@ use protocol_types::{address::AztecAddress, traits::FromField};
 pub global AUTH_REGISTRY_ADDRESS: AztecAddress = AztecAddress::from_field(
     0x1f7f0c3d878160356b2025b056a7a390ab34bd17f2ba4320ffb4a71698d5bf3a,
 );
+
+pub global PUBLIC_CHECKS_ADDRESS: AztecAddress = AztecAddress::from_field(
+    0x0ed9aa9b8262bd0afb923764799e058ad10cf0de3e01dcf955055b11fdb20d70,
+);
diff --git a/noir-projects/noir-contracts/Nargo.toml b/noir-projects/noir-contracts/Nargo.toml
@@ -28,11 +28,11 @@ members = [
     "contracts/fees/sponsored_fpc_contract",
     "contracts/message_discovery/handshake_registry_contract",
     "contracts/standard/auth_registry_contract",
+    "contracts/standard/public_checks_contract",
     "contracts/protocol/contract_class_registry_contract",
     "contracts/protocol/contract_instance_registry_contract",
     "contracts/protocol/fee_juice_contract",
     "contracts/protocol/multi_call_entrypoint_contract",
-    "contracts/protocol/public_checks_contract",
     "contracts/protocol_interface/contract_instance_registry_interface",
     "contracts/protocol_interface/fee_juice_interface",
     "contracts/test/generic_proxy_contract",
diff --git a/noir-projects/noir-contracts/contracts/standard/public_checks_contract/Nargo.toml b/noir-projects/noir-contracts/contracts/standard/public_checks_contract/Nargo.toml
diff --git a/noir-projects/noir-contracts/contracts/standard/public_checks_contract/src/main.nr b/noir-projects/noir-contracts/contracts/standard/public_checks_contract/src/main.nr
diff --git a/noir-projects/noir-contracts/contracts/standard/public_checks_contract/src/test.nr b/noir-projects/noir-contracts/contracts/standard/public_checks_contract/src/test.nr
diff --git a/noir-projects/noir-contracts/protocol_contracts.json b/noir-projects/noir-contracts/protocol_contracts.json
@@ -2,6 +2,5 @@
   "contract_instance_registry_contract-ContractInstanceRegistry",
   "contract_class_registry_contract-ContractClassRegistry",
   "multi_call_entrypoint_contract-MultiCallEntrypoint",
-  "fee_juice_contract-FeeJuice",
-  "public_checks_contract-PublicChecks"
+  "fee_juice_contract-FeeJuice"
 ]
diff --git a/noir-projects/noir-protocol-circuits/crates/types/src/constants.nr b/noir-projects/noir-protocol-circuits/crates/types/src/constants.nr
@@ -232,7 +232,6 @@ pub global CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS: AztecAddress = AztecAddr
 pub global CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS: AztecAddress = AztecAddress::from_field(3);
 pub global MULTI_CALL_ENTRYPOINT_ADDRESS: AztecAddress = AztecAddress::from_field(4);
 pub global FEE_JUICE_ADDRESS: AztecAddress = AztecAddress::from_field(5);
-pub global PUBLIC_CHECKS_ADDRESS: AztecAddress = AztecAddress::from_field(6);
 
 // `SIDE_EFFECT_MASKING_ADDRESS` is used by the protocol circuits to silo the padding side effects. It's not a protocol
 // contract (hence its address is greater than `MAX_PROTOCOL_CONTRACTS`).
diff --git a/yarn-project/aztec.js/src/api/protocol.ts b/yarn-project/aztec.js/src/api/protocol.ts
@@ -5,4 +5,3 @@ export { ContractClassRegistryContract } from '../contract/protocol_contracts/co
 export { ContractInstanceRegistryContract } from '../contract/protocol_contracts/contract-instance-registry.js';
 export { FeeJuiceContract } from '../contract/protocol_contracts/fee-juice.js';
 export { MultiCallEntrypointContract } from '../contract/protocol_contracts/multi-call-entrypoint.js';
-export { PublicChecksContract } from '../contract/protocol_contracts/public-checks.js';
diff --git a/yarn-project/constants/src/constants.gen.ts b/yarn-project/constants/src/constants.gen.ts
@@ -121,7 +121,6 @@ export const CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS = 2;
 export const CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS = 3;
 export const MULTI_CALL_ENTRYPOINT_ADDRESS = 4;
 export const FEE_JUICE_ADDRESS = 5;
-export const PUBLIC_CHECKS_ADDRESS = 6;
 export const SIDE_EFFECT_MASKING_ADDRESS = 19523154334483583633304358390644137470227519736821975910774528428729027989987n;
 export const NULL_MSG_SENDER_CONTRACT_ADDRESS = 21888242871839275222246405745257275088548364400416034343698204186575808495616n;
 export const CONTRACT_CLASS_REGISTRY_BYTECODE_CAPSULE_SLOT = 14193106819744442689484501689686180698286338820089744102289275815863062044599n;
diff --git a/yarn-project/constants/src/scripts/constants.in.ts b/yarn-project/constants/src/scripts/constants.in.ts
@@ -28,7 +28,6 @@ const CPP_CONSTANTS = [
   'MULTI_CALL_ENTRYPOINT_ADDRESS',
   'FEE_JUICE_ADDRESS',
   'TX_DA_GAS_OVERHEAD',
-  'PUBLIC_CHECKS_ADDRESS',
   'FEE_JUICE_BALANCES_SLOT',
   'UPDATED_CLASS_IDS_SLOT',
   'UPDATES_DELAYED_PUBLIC_MUTABLE_VALUES_LEN',
@@ -175,7 +174,6 @@ const PIL_CONSTANTS = [
   'CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS',
   'MULTI_CALL_ENTRYPOINT_ADDRESS',
   'FEE_JUICE_ADDRESS',
-  'PUBLIC_CHECKS_ADDRESS',
   'FEE_JUICE_BALANCES_SLOT',
   'TIMESTAMP_OF_CHANGE_BIT_SIZE',
   'UPDATES_DELAYED_PUBLIC_MUTABLE_METADATA_BIT_SIZE',
diff --git a/yarn-project/protocol-contracts/src/provider/bundle.ts b/yarn-project/protocol-contracts/src/provider/bundle.ts
@@ -7,15 +7,13 @@ import { makeProtocolContract } from '../make_protocol_contract.js';
 import { MultiCallEntrypointArtifact } from '../multi-call-entrypoint/index.js';
 import type { ProtocolContract } from '../protocol_contract.js';
 import type { ProtocolContractName } from '../protocol_contract_data.js';
-import { PublicChecksArtifact } from '../public-checks/index.js';
 import type { ProtocolContractsProvider } from './protocol_contracts_provider.js';
 
 export const ProtocolContractArtifact: Record<ProtocolContractName, ContractArtifact> = {
   ContractInstanceRegistry: ContractInstanceRegistryArtifact,
   ContractClassRegistry: ContractClassRegistryArtifact,
   MultiCallEntrypoint: MultiCallEntrypointArtifact,
   FeeJuice: FeeJuiceArtifact,
-  PublicChecks: PublicChecksArtifact,
 };
 
 export class BundledProtocolContractsProvider implements ProtocolContractsProvider {
diff --git a/yarn-project/protocol-contracts/src/provider/lazy.ts b/yarn-project/protocol-contracts/src/provider/lazy.ts
@@ -4,7 +4,6 @@ import { getCanonicalInstanceRegistry } from '../instance-registry/lazy.js';
 import { getCanonicalMultiCallEntrypoint } from '../multi-call-entrypoint/lazy.js';
 import type { ProtocolContract } from '../protocol_contract.js';
 import type { ProtocolContractName } from '../protocol_contract_data.js';
-import { getCanonicalPublicChecks } from '../public-checks/lazy.js';
 import type { ProtocolContractsProvider } from './protocol_contracts_provider.js';
 
 export class LazyProtocolContractsProvider implements ProtocolContractsProvider {
@@ -18,8 +17,6 @@ export class LazyProtocolContractsProvider implements ProtocolContractsProvider
         return getCanonicalMultiCallEntrypoint();
       case 'FeeJuice':
         return getCanonicalFeeJuice();
-      case 'PublicChecks':
-        return getCanonicalPublicChecks();
       default:
         throw new Error(`Unknown protocol contract name: ${name}`);
     }
diff --git a/yarn-project/protocol-contracts/src/public-checks/index.ts b/yarn-project/protocol-contracts/src/public-checks/index.ts
diff --git a/yarn-project/protocol-contracts/src/public-checks/lazy.ts b/yarn-project/protocol-contracts/src/public-checks/lazy.ts
diff --git a/yarn-project/protocol-contracts/src/scripts/generate_data.ts b/yarn-project/protocol-contracts/src/scripts/generate_data.ts
@@ -9,7 +9,6 @@ import {
   FEE_JUICE_ADDRESS,
   MAX_PROTOCOL_CONTRACTS,
   MULTI_CALL_ENTRYPOINT_ADDRESS,
-  PUBLIC_CHECKS_ADDRESS,
 } from '@aztec/constants';
 import { makeTuple } from '@aztec/foundation/array';
 import { Fr } from '@aztec/foundation/curves/bn254';
@@ -43,7 +42,6 @@ const contractAddressMapping: { [name: string]: number } = {
   ContractClassRegistry: CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS,
   MultiCallEntrypoint: MULTI_CALL_ENTRYPOINT_ADDRESS,
   FeeJuice: FEE_JUICE_ADDRESS,
-  PublicChecks: PUBLIC_CHECKS_ADDRESS,
 };
 
 async function clearDestDir() {
diff --git a/yarn-project/standard-contracts/src/index.ts b/yarn-project/standard-contracts/src/index.ts
@@ -1 +1,2 @@
 export * from './auth-registry/index.js';
+export * from './public-checks/index.js';
diff --git a/yarn-project/standard-contracts/src/public-checks/address.ts b/yarn-project/standard-contracts/src/public-checks/address.ts
@@ -0,0 +1,7 @@
+// Address-only leaf export for browser bundles: importing from
+// `@aztec/standard-contracts/public-checks/address` avoids dragging in the
+// `PublicChecks.json` static import.
+import { StandardContractAddress, StandardContractClassId } from '../standard_contract_data.js';
+
+export const PUBLIC_CHECKS_ADDRESS = StandardContractAddress.PublicChecks;
+export const PUBLIC_CHECKS_CLASS_ID = StandardContractClassId.PublicChecks;
diff --git a/yarn-project/standard-contracts/src/public-checks/index.ts b/yarn-project/standard-contracts/src/public-checks/index.ts
@@ -0,0 +1,20 @@
+import { loadContractArtifact } from '@aztec/stdlib/abi';
+import type { NoirCompiledContract } from '@aztec/stdlib/noir';
+
+import PublicChecksJson from '../../artifacts/PublicChecks.json' with { type: 'json' };
+import { makeStandardContract } from '../make_standard_contract.js';
+import type { StandardContract } from '../standard_contract.js';
+
+export { PUBLIC_CHECKS_ADDRESS, PUBLIC_CHECKS_CLASS_ID } from './address.js';
+
+export const PublicChecksArtifact = loadContractArtifact(PublicChecksJson as NoirCompiledContract);
+
+let standardContract: StandardContract;
+
+/** Returns the standard deployment of public_checks. */
+export function getStandardPublicChecks(): Promise<StandardContract> {
+  if (!standardContract) {
+    standardContract = makeStandardContract('PublicChecks', PublicChecksArtifact);
+  }
+  return Promise.resolve(standardContract);
+}
diff --git a/yarn-project/standard-contracts/src/public-checks/lazy.ts b/yarn-project/standard-contracts/src/public-checks/lazy.ts
@@ -0,0 +1,31 @@
+import { type ContractArtifact, loadContractArtifact } from '@aztec/stdlib/abi';
+
+import { makeStandardContract } from '../make_standard_contract.js';
+import type { StandardContract } from '../standard_contract.js';
+
+export { PUBLIC_CHECKS_ADDRESS, PUBLIC_CHECKS_CLASS_ID } from './address.js';
+
+let standardContract: StandardContract;
+let standardContractArtifact: ContractArtifact;
+
+export async function getPublicChecksArtifact(): Promise<ContractArtifact> {
+  if (!standardContractArtifact) {
+    // Cannot assert this import as it's incompatible with bundlers like vite
+    // https://github.com/vitejs/vite/issues/19095#issuecomment-2566074352
+    // Even if now supported by all major browsers, the MIME type is replaced with
+    // "text/javascript"
+    // In the meantime, this lazy import is INCOMPATIBLE WITH NODEJS
+    const { default: publicChecksJson } = await import('../../artifacts/PublicChecks.json');
+    standardContractArtifact = loadContractArtifact(publicChecksJson);
+  }
+  return standardContractArtifact;
+}
+
+/** Returns the standard deployment of public_checks. */
+export async function getStandardPublicChecks(): Promise<StandardContract> {
+  if (!standardContract) {
+    const artifact = await getPublicChecksArtifact();
+    standardContract = makeStandardContract('PublicChecks', artifact);
+  }
+  return standardContract;
+}
diff --git a/yarn-project/standard-contracts/src/scripts/generate_data.ts b/yarn-project/standard-contracts/src/scripts/generate_data.ts
@@ -35,6 +35,7 @@ const deployer = AztecAddress.zero();
 // a new standard contract.
 const standardContracts: { name: string; src: string; nrConst: string | null }[] = [
   { name: 'AuthRegistry', src: 'auth_registry_contract-AuthRegistry', nrConst: 'AUTH_REGISTRY_ADDRESS' },
+  { name: 'PublicChecks', src: 'public_checks_contract-PublicChecks', nrConst: 'PUBLIC_CHECKS_ADDRESS' },
 ];
 
 async function clearDestDir() {
diff --git a/yarn-project/standard-contracts/src/standard_contract_data.ts b/yarn-project/standard-contracts/src/standard_contract_data.ts
@@ -3,20 +3,23 @@ import { Fr } from '@aztec/foundation/curves/bn254';
 import { FunctionSelector } from '@aztec/stdlib/abi';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 
-export const standardContractNames = ['AuthRegistry'] as const;
+export const standardContractNames = ['AuthRegistry', 'PublicChecks'] as const;
 
 export type StandardContractName = (typeof standardContractNames)[number];
 
 export const StandardContractSalt: Record<StandardContractName, Fr> = {
   AuthRegistry: new Fr(1),
+  PublicChecks: new Fr(1),
 };
 
 export const StandardContractAddress: Record<StandardContractName, AztecAddress> = {
   AuthRegistry: AztecAddress.fromString('0x1f7f0c3d878160356b2025b056a7a390ab34bd17f2ba4320ffb4a71698d5bf3a'),
+  PublicChecks: AztecAddress.fromString('0x0ed9aa9b8262bd0afb923764799e058ad10cf0de3e01dcf955055b11fdb20d70'),
 };
 
 export const StandardContractClassId: Record<StandardContractName, Fr> = {
   AuthRegistry: Fr.fromString('0x22586102100c4e25fea653d1edc4f3ef903e431ebc7725f70dafaea28a74e8a7'),
+  PublicChecks: Fr.fromString('0x1853dc3b22d13d7fb93a089c366125098bf0f4a169255e12fc3765b3c08c3b6d'),
 };
 
 export const StandardContractClassIdPreimage: Record<
@@ -28,15 +31,23 @@ export const StandardContractClassIdPreimage: Record<
     privateFunctionsRoot: Fr.fromString('0x06e0363cea8d971d0c2988a13fc88774092b2858adc5ee0876ed2f9ad05e2f63'),
     publicBytecodeCommitment: Fr.fromString('0x2545f39893766508ce37bb5cea5e4dcab04c6f7f79f3089b1c076876e9d268b2'),
   },
+  PublicChecks: {
+    artifactHash: Fr.fromString('0x2b11692497c9a3f1f44f4694d1ffb1e521d8cd6ba0e2ef3878026fe9c12fd854'),
+    // REGENERATE: privateFunctionsRoot and publicBytecodeCommitment are placeholders; run `yarn generate` against fully vk-stamped artifacts to refresh.
+    privateFunctionsRoot: Fr.fromString('0x0000000000000000000000000000000000000000000000000000000000000000'),
+    publicBytecodeCommitment: Fr.fromString('0x0000000000000000000000000000000000000000000000000000000000000000'),
+  },
 };
 
 export const StandardContractInitializationHash: Record<StandardContractName, Fr> = {
   AuthRegistry: Fr.fromString('0x0000000000000000000000000000000000000000000000000000000000000000'),
+  PublicChecks: Fr.fromString('0x0000000000000000000000000000000000000000000000000000000000000000'),
 };
 
 export const StandardContractPrivateFunctions: Record<
   StandardContractName,
   { selector: FunctionSelector; vkHash: Fr }[]
 > = {
   AuthRegistry: [],
+  PublicChecks: [],
 };
